Phoenix Contact Classic Line Industrial Controllers Missing Authentication For Critical Function (CVE-2019-9201)

critical Tenable OT Security Plugin ID 500775

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Multiple Phoenix Contact devices allow remote attackers to establish TCP sessions to port 1962 and obtain sensitive information or make changes, as demonstrated by using the Create Backup feature to traverse all directories.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Phoenix Contact has provided the following mitigations and workarounds:

- Phoenix Contact classic line controllers are designed and developed for use in closed industrial networks. The control and configuration protocols do not feature authentication mechanisms by design. Phoenix Contact recommends using the devices exclusively in closed networks, protected by a suitable firewall.
- If the use of an affected controller in protected zones is not suitable, OT communication protocols should be disabled either by using the CPU services via console or web-based management according to the controller type.
- Information for which controllers and from which firmware version communication protocols can be disabled are described in Phoenix Contact’s application note for classic line controllers, or the manual to the respective controller, which is available for download at the Phoenix Contact website.

For detailed information on Phoenix Contact’s recommendations for measures to protect network-capable devices, please refer to their application note for classic line controllers:

Measures to protect devices based on classic control technology

Controller supporting CPU services or WBM for disabling communication protocols:

- ILC 1x0: All variants, firmware: no fix
- ILC 1x1: All variants, firmware: 4.42
- ILC 1x1 GMS/GPRS: Article number2700977, firmware: 4.42
- ILC 3xx: All variants, firmware 3.98
- AXC 1050: Article number 2700988, firmware 3.01, 5.00 (WBM)
- AXC 1050XC: Article number 2701295, firmware 3.01, 5.00 (WBM)
- AXC 3050: Article number 2700989, firmware 5.60, 6.30 (WBM)
- RFC 480S PN 4TX: Article number 2404577, firmware 6.10
- RFC 470 PN 3TX: Article number 291660, firmware 4.20
- RFC 470S PN 3TX: Article number 2916794, firmware 4.20
- RFC 460R PN 3TX: Article number 2700784, firmware 5.00
- RFC 460R PN 3TX-S: Article number 1096407, firmware 5.30
- RFC 430 ETH-IB: Article number 2730190, no fix
- RFC 450 ETH-IB: Article number 2730200, no fix
- PC WORX SRT: Article number 2701680, no fix
- PC WORX RT BASIC: Article number 2700291, no fix
- FC 350 PCI ETH: Article number 2730844, no fix

Plugin Details

Severity: Critical

ID: 500775

Version: 1.6

Type: remote

Family: Tenable.ot

Published: 1/25/2023

Updated: 3/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2019-9201

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:phoenixcontact:axc_1050_firmware:-, cpe:/o:phoenixcontact:ilc_131_eth%2fxc_firmware:-, cpe:/o:phoenixcontact:ilc_131_eth_firmware:-, cpe:/o:phoenixcontact:ilc_151_eth%2fxc_firmware:-, cpe:/o:phoenixcontact:ilc_151_eth_firmware:-, cpe:/o:phoenixcontact:ilc_171_eth_2tx_firmware:-, cpe:/o:phoenixcontact:ilc_191_eth_2tx_firmware:-, cpe:/o:phoenixcontact:ilc_191_me%2fan_firmware:-

Required KB Items: Tenable.ot/PhoenixContact

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/26/2019

Vulnerability Publication Date: 2/26/2019

Reference Information

CVE: CVE-2019-9201

CWE: 306

Detections

Analytics